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From the first days of the M ercury program to today's efforts 
aboard the International Space Station, human safety has always 
been the primary consideration for human spaceflight. 

Looking backward, consider N ASA's first attempts to reach 
space without human crews. Rockets tipped over, rockets exploded 
on lift off, rockets careened off course. . . it sure didn't look safe. 

Before we could put a life at risk, the rockets had to be 
made safer. How? M ostly through the application of brute-force 
engineering — essentially the "Fly, Fix, Fly" approach. 

This approach did eventually lead to safer rockets; how- 
ever, to produce a spacecraft intended for routine human flight 
into space, NASA needed to design safety into the vehicle, not 
just add safety on after a problem was discovered. This need 
drove NASA to become the home of some of the world's best 
design engineers and produced some of the best system safety, 
quality, and reliability engineers. 

N ASA demonstrated through theM ercury program that we 
could launch a human into orbit around the Earth and recover 
the astronaut and spacecraft safely. During the Gemini program, 
we perfected complex rendezvous and docking in space, and per- 
formed spacewalks. Both astronauts and equipment operated safely 
during longer durations in space. By thetimetheGemini program 
ended, NASA was doing what was once thought impossible. 
Even with increasingly complex equipment and quick turn- 
arounds between missions, the astronauts always returned home 
safely. Success was becoming routine and expected. 

NASA experienced a rude awakening in January 1967, 
when the Apollo 1 capsule burst into flames during a preflight 


75 


L ooking Backward, L ooking Forward 


ground test. The three astronauts performing the test perished in 
theblaze. The test had called for simulating a launch configuration, 
so the capsule was pressurized with 100 percent oxygen, and the 
hatch was sealed. Investigators determined that an electrical 
short sparked thefire. In a 100-percent oxygen environment, thefire 
quickly engulfed the capsule. But the test was being performed 
with an unfueled launch vehicle, so it was not considered haz- 
ardous! NASA never considered the possibility of a fire during 
the test— crew evacuation and fire suppression were not part of 
the test scenario. 

NASA responded to this tragedy by strengthening safety 
oversight, clarifying responsibilities, improving communications, 
improving test safety analysis and emergency procedures, and 
making safety design enhancements to the Apollo spacecraft. 
Congress established the Aerospace Safety Advisory Panel to 
provide an independent review of the safety of N ASA programs 
and operations. NASA established an Office of Flight Safety, 
independent of the flight program office, to review all aspects of 
design, manufacturing, test, and flight from a safety standpoint. 

NASA recovered from this tragedy. NASA astronauts 
landed on the M oon six times and returned safely. The Apollo 
13 mission demonstrated that N ASA could recover from a serious 
technical mishap and return the crew safely to Earth. In the 
1970s, NASA conducted the Apollo-Soyuz program and the 
Skylab program— logging more human spaceflight success. 

For a period of time, America did not have a regular human 
presence in space. Throughout the 1970s, we were developing 
and building the next generation of [the] reusable space vehicle, 
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the Space Shuttle. In the mid-1970s, Agencywide advocacy forflight 
safety became the responsibility of the NASA Chief Engineer. 

From 1981 to 1986, NASA flew twenty-four Space Shuttle 
missions. Although we experienced some anomalies along the 
way, the astronauts always returned home safely. 

Again, success was becoming routine— until a cold January 
day in 1986, when the Space Shuttle Challenger suffered a major 
failure in the seals of one of its boosters and exploded 73 seconds 
after liftoff. All seven crewmembers were killed. 

In the painful months that followed, there were indepth, 
critical reviews by NASA and external bodies. The Shuttle pro- 
gram was grounded, and each safety practice was dissected and 
examined. Safety goals and procedures were revisited; even orga- 
nizational and individual attitudes were considered. The reviews 
found a number of management flaws. For example, O-ring seal 
problems in the boosters had surfaced on previous missions. 
Flowever, this information was not widely circulated. Concerns 
expressed by safety engineers did not always reach management 
in a timely manner. Additionally, the magnitude of the risk and 
the associated ramifications may not have been fully understood 
by the decision-makers. There had been growing pressure on 
N ASA to launch the Shuttle regularly and on schedule. N o one 
believed that they had enough data to prove that the launch was 
not safe. A collective mindset evolved— if no one could prove 
that the launch was unsafe, it must be safe! 

In the few years after the Challenger accident, NASA put 
in place a number of improvements to its safety program. These 
included: 
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• Creating an independent safety organization, reporting 

directly to the Administrator. 

* Increasing the budget and staffing for safety, reliability, 
maintainability, and quality assurance. 

• Improving communications. NASA created an additional 

avenue to communicate safety concerns in a confidential 
manner— the NASA Safety Reporting System. 

* Strengthening risk-management programs and initiating 

significant problem reporting, trend analysis, and inde- 
pendent systems assessment capability. 

These improvements form the basis for today's Safety and 
M ission Assurance Program, and since return-to-flight in 1988, 
every NASA Space Shuttle flight has flown and landed safely. 

H ow has human spaceflight safety advanced over the past 
forty years? Well, for one thing, we know more. We know more 
about engineering, materials, and robotics. Safety and mission 
assurance tools are much more advanced. We have the capability 
of improved nondestructive evaluation, and we can do computer 
modeling and sophisticated "what if" scenarios. 

Today, we know more about program management and 
more about what it takes to fly safely. We know that there are a 
million things that can go wrong, and we know that we can 
never become complacent. Wewill notallow ourselves to be bul- 
lied by schedules, and we won't let cost constraints make us 
skimp on safety. 

We don't ask our engineers and managers and experts to 
prove it is not safe to fly. Rather, we ask them to prove that it is safe. 
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This is a philosophical change from the days before Challenger 
and a fundamental management principle for safety of flight. 

Today's human spaceflight safety prelaunch assessment 
review process is independent and comprehensive. For each launch, 
NASA managers prepare a Certificate Of Flight Readiness— we 
call it the COFR. Before I sign the COFR, I must personally 
understand all the safety issues and their resolution. If I do not 
have confidence that everything has been doneto maketheflight 
as safe as it can be, it is my job to not sign the COFR. The 
Administrator would not have it any other way. 

The International Space Station heralds a new era of space 
exploration for America. On this program, safety is NASA's 
highest priority. My staff performs continuous oversight and 
independent assessment on the design, development, and operation 
of the International Space Station. 

In sum, I'd like to describe the illustration shown [on page 
74], This picture represents N ASA's safety hierarchy. We articu- 
lated the safety hierarchy a little over two years ago, as part of 
our quest to be the nation's leader in safety and occupational 
health, and in the safety of the products and services we provide. 
The safety hierarchy stresses that we are all accountable for 
assuring that our programs, projects, and operations do not 
impact safety or health for the public, astronauts and pilots, 
employees on the ground, and high-value equipment and property. 

When people are thinking about doing things safely, 
they're also thinking about doing things right. And for the past 
couple of years, we've had some pretty good results. In the time 
since the failures of the M ars 98 missions that occurred in late 
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1999, every N ASA spacecraft launch has met the success objec- 
tives, and every Space Shuttle mission has safely and successfully 
met all mission objectives. Now I can't say that NASA's safety 
program is solely responsible for these achievements, but, as we 
like to say, "mission success starts with safety." 

In the future, looking forward, we will continue to make 
spaceflight even safer. That is NASA's vision. That is NASA's 
duty to both those who will travel into space and the American 
peoplewho will make the journey possible. 
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